The vulnerability allows a low‑privileged portal user to upload a malicious case‑report template that is later executed by the backend’s non‑sandboxed Jinja2 engine whenever an admin or analyst generates a report. The injected Jinja expressions are evaluated as arbitrary Python code, enabling an attacker to run arbitrary commands as the application’s root process, exfiltrate all tenants’ incident data, and access stored connector credentials. In addition, the PDF renderer permits local‑file reads and requests to internal services, expanding the potential impact beyond code execution.

SOCFortress CoPilot, any deployment of the software prior to version 0.1.76. The vulnerability exists in the case‑report template handling code shared across all customer installations that use the default global template store, and occurs in the backend routes and report rendering services of that product.

The flaw carries a CVSS score of 9, indicating high severity, but its EPSS score is not available; the issue is not yet listed in the CISA KEV catalog. Exploitation requires that a malicious user has a customer_user role with permission to upload templates and that an authorized analyst or administrator subsequently triggers a report generation, which is a common action in normal usage. Because the Jinja environment is not sandboxed and auto‑escaping is disabled, the attacker can execute arbitrary system commands, resulting in full compromise of the backend. The exploit is straightforward once the privileges described are available, making the risk high despite the absence of an EPSS figure.